Directory traversal in pooledwebsocket

ÉLEVÉE 7.5CVE-2017-16107 · GHSA-cfxm-4p54-5w7h · Published 07/06/2018 · updated 17/06/2026

En bref

CVE-2017-16107 est une vulnérabilité ÉLEVÉE (CVSS 7.5) touchant pooledwebsocket (pooledwebsocket project), pooledwebsocket.
Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 2.0%, plus élevée que 80.6% des vulnérabilités.
Correctif : mettre à jour vers 0.0.19 ou plus récent.

Package	Affected versions	Patched versions
pooledwebsocket pooledwebsocket_project	`≥ 0.0.1, ≤ 0.0.18`	No fix yet
pooledwebsocket npm	`< 0.0.19`	`0.0.19`

Description

Affected versions of pooledwebsocket resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

Example request:

GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo

Recommendation

Update to version 0.0.19 or later.

NVD description

pooledwebsocket is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url.

References

nvd.nist.gov/vuln/detail/CVE-2017-16107 · ADVISORY
JacksonGL/NPM-Vuln-PoC · WEB
GitHub Advisory GHSA-cfxm-4p54-5w7h · ADVISORY
npmjs.com/advisories/341 · WEB
nodesecurity.io/advisories/341 · Exploit

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free